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Abstract': 



Doubleclick is an advertising agency that is employing the 
Internet for advertising purposes. The company employs user 
demographic profiles to target its advertising. The problem 
is, Doubleclick is using Netscape cookies to obtain the user 
information without the user's knowledge. The information 
includes the user's operating system and location as well as 
the name of the user's organization and its type, size and 
revenue levels. The information is obtained from the Internet 
Profiles Database, based on the user's IP address and cookie 
ID if they are using Netscape. Doubleclick uses the 
information to decide which advertising banner to display to 
that user. The company sells advertising through more than 3 0 
Web sites, including USA Today Online, Travelocity and Quicken 
Financial. User concerns center on the access of information 
stored on their own systems and its employment for the 
collection and distribution of information about them. 



Full Text: 



Fighting potential abuses of the Internet often seems to take on elements 
of shadowboxing you can't always tell whether there's a real enemy or 
not. Our recent discussions about junk e-mail and other questionable 
marketing practices on the 'net prompted one reader to alert The Gripe 
Line to a company called Doubleclick. 

"Doubleclick is targeting advertising based on a user's demographic 
profile," the reader wrote. "There's nothing wrong with that; in fact, 
that seems to be a step in the right direction. The catch is that they 
are using Netscape cookies to collect and store this data without the 
user being aware it's happening." 

I visited Doubleclick's Web site (http://www.doubleclick.net), and it did 
seem fairly ominous. Doubleclick sells advertising through a variety of 
Web sites that include USA Today Online, Quicken Financial, Travelocity, 
and mbre than 3 0 others. 

"When a user accesses a doubleclick.net member Web site, the user's 
browser makes a request [transparent to the user] to double click: net for 
an ad banner," read one of Doubleclick's Web pages. "Doubleclick 
retrieves information about the user, based on their IP address and 
cookie ID [if running Netscape!, from the Internet Profiles Database." 

The Doubleclick software uses the information to decide which ad banner 
is most appropriate to display to that user. What kind of information do 
they have in that database? 



"Doubleclick has created the largest and most complete user and 



organization database on tire Internet , " another Web document explained. 
^Doubleclick is able to tell an incredible amount of information about a 
user, such as operating system, location, organization name, type, 
revenue, and size." 

My reader objected to the use of the Netscape cookie to apparently 
collect this data on Web surfers who may not know that either Doubleclick 
or the cookie file exists. 

"Here we have a clear situation where information is being gathered about 
a particular user without that user's knowledge," the reader wrote. "Even 
the target marketing cards that masquerade as warranty registrations in 
every appliance or electronic device known to mankind give the user a 
choice to check a box to deny the right to share or sell the information 
provided. This check has been removed in the rush to the online world. I 
am concerned about where this tacit assumption that we give up our rights 
to our privacy as we head into an online world will lead us." 

I was concerned, too. Now that I had been on Doubleclick's Web site, my 
own cookie file sported a Doubleclick cookie, ready to identify me to any 
other DoubleClick-enabled site. It didn't bother me that it would use 
that information to decide which ad to show me, but it did seem wrong 
that a file on my own system would be used to collect and pass on 
information about me. 



I decided to contact the company CEO and president, Kevin O'Connor. 

"There are a lot of misperceptions about the cookie file and what it can 
do, " O'Connor said. "All we're using it for is to keep track of which ads 
we've shown you so you don't keep seeing the same one." 

Information about the user's geographical location and company 
affiliation is derived from the IP address, not the cookie file, O'Connor 
said, and the user's browser identifies itself and the operating system 
it's running under. 

In spite of the company's claims about its user database, O'Connor said 
that Doubleclick does not use information about other sites the user has 
accessed when choosing the ad banner to display, and the company does not 
try to identify the user's name. 

"Without question there is potential to misuse information, but that's 
always been there," O'Connor said. "The potential for abuse on the Web is 
great, because it is so powerful. But it really has little to do with 
cookies . " 

From what I've been able to gather from Netscape and from Brett Glass' 
column last week, it looks like O'Connor is right about the dangers of 
the cookie file being greatly exaggerated. (See Help Desk, July 15, page 
54.) Still, I'm going to keep an eye on it. After all, telling friend 
from foe on the Internet is still a tricky business. 

Ed Foster's Gripe Line examines issues raised by readers concerning 
product quality, customer service, and sales practices. Send gripes to 
gripe@infoworld.com or call (800) 227-8365, Ext. 710. Join his New'Gripes 
forum on InfoWorld Electric at http://www.infoworld.com. 
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